diff --git a/config.xml b/config.xml
index ce83dfb..7f75ec5 100644
--- a/config.xml
+++ b/config.xml
@@ -794,6 +794,27 @@ eB5vhzf2Buj0CaEaqDF/dVMuss6x++eHeWqU3Ss2s13VFsJkelWwByxcTKJha4s34dYXWByMDAO4cXzm
     </rule>
   </nat>
   <filter>
+    <rule uuid="b65db90d-8fc3-45dd-a390-e7186b8d86d8">
+      <type>block</type>
+      <interface>wan</interface>
+      <ipprotocol>inet</ipprotocol>
+      <statetype>keep state</statetype>
+      <descr>Blocklist IP WAN - scans NPM</descr>
+      <direction>in</direction>
+      <quick>1</quick>
+      <log>1</log>
+      <source>
+        <address>IP_BLOCKLIST</address>
+      </source>
+      <destination>
+        <any>1</any>
+      </destination>
+      <created>
+        <username>Hermes</username>
+        <time>1793429549</time>
+        <description>Blocage autorise par Gilles de 195.178.110.199</description>
+      </created>
+    </rule>
     <rule uuid="2ed3a882-54e8-4481-803f-b27f84e1136a">
       <type>block</type>
       <interface>wan</interface>
@@ -1213,8 +1234,8 @@ eB5vhzf2Buj0CaEaqDF/dVMuss6x++eHeWqU3Ss2s13VFsJkelWwByxcTKJha4s34dYXWByMDAO4cXzm
   </widgets>
   <revision>
     <username>(root)</username>
-    <description>/usr/local/opnsense/mvc/script/run_migrations.php made changes</description>
-    <time>1791114251.14</time>
+    <description>Hermes: block 195.178.110.199 on WAN via IP_BLOCKLIST</description>
+    <time>1793429549.64</time>
   </revision>
   <OPNsense>
     <wireguard>
@@ -1399,6 +1420,23 @@ RU</content>
             <categories/>
             <description>PAYS_BLOQUES</description>
           </alias>
+          <alias uuid="89ff8cfd-38f4-4e61-aafe-cdfd02fb904c">
+            <enabled>1</enabled>
+            <name>IP_BLOCKLIST</name>
+            <type>host</type>
+            <path_expression/>
+            <proto/>
+            <interface/>
+            <counters>1</counters>
+            <updatefreq/>
+            <content>195.178.110.199</content>
+            <password/>
+            <username/>
+            <authtype/>
+            <expire/>
+            <categories/>
+            <description>IPs bloquees manuellement - scans confirmes NPM</description>
+          </alias>
         </aliases>
       </Alias>
       <Category version="1.0.0">